Miles Prower
2 months ago
committed by
GitHub
1 changed files with 0 additions and 97 deletions
@ -1,97 +0,0 @@ |
|||||||
name: Duplicate malware/virus flags issues handler |
|
||||||
|
|
||||||
on: |
|
||||||
issues: |
|
||||||
types: [opened] |
|
||||||
|
|
||||||
jobs: |
|
||||||
check_keywords: |
|
||||||
runs-on: ubuntu-22.04 |
|
||||||
steps: |
|
||||||
- name: Checkout repository |
|
||||||
uses: actions/checkout@v4 |
|
||||||
with: |
|
||||||
persist-credentials: false |
|
||||||
|
|
||||||
- name: Check for keywords in issue title and body |
|
||||||
id: check_keywords |
|
||||||
run: | |
|
||||||
# Define the list of keywords |
|
||||||
keywords=("Virus" "Malware" "trojan" "Windows Defender" "Antivirus" "bitdefender" "defender" "kaspersky" "unwanted" "harmful" "HackTool:Win64/ExplorerPatcher!MTB" "HackTool:Win64/Patcher!MSR" "HackTool" "Backdoor" "detection" "Norton" "Windows Security" "Win64:MalwareX-gen" "Microsoft Defender" "infected" "Potentially unwanted app found" "potentially unwanted software" "VIRUSTOTAL") |
|
||||||
|
|
||||||
# Get the issue title and body from the event context |
|
||||||
ISSUE_TITLE="${{ github.event.issue.title }}" |
|
||||||
|
|
||||||
# Convert both title and body to lowercase for case-insensitive comparison |
|
||||||
ISSUE_TITLE_LOWER=$(echo "$ISSUE_TITLE" | tr '[:upper:]' '[:lower:]') |
|
||||||
|
|
||||||
# Check if any of the keywords are present in the title or body |
|
||||||
for keyword in "${keywords[@]}"; do |
|
||||||
# Convert the keyword to lowercase as well |
|
||||||
KEYWORD_LOWER=$(echo "$keyword" | tr '[:upper:]' '[:lower:]') |
|
||||||
|
|
||||||
if [[ "$ISSUE_TITLE_LOWER" == *"$KEYWORD_LOWER"* ]] || [[ "$ISSUE_BODY_LOWER" == *"$KEYWORD_LOWER"* ]]; then |
|
||||||
echo "'$keyword' found" |
|
||||||
echo "contains_keyword=true" >> $GITHUB_ENV |
|
||||||
break |
|
||||||
fi |
|
||||||
done |
|
||||||
|
|
||||||
- name: Comment, label, and close issue if keyword found |
|
||||||
if: env.contains_keyword == 'true' # Only run if a keyword was found |
|
||||||
run: | |
|
||||||
ISSUE_NUMBER="${{ github.event.issue.number }}" |
|
||||||
REPO="${{ github.repository }}" |
|
||||||
|
|
||||||
# Define the body of the comment with Markdown formatting |
|
||||||
COMMENT_BODY="> [!CAUTION] |
|
||||||
><ins>**Microsoft and other major antivirus vendors have flagged ExplorerPatcher as \"malware\".**</ins> This is likely due to Microsoft's hatred against ExplorerPatcher, not because it contains a virus or such. Flags from Microsoft usually spread to other antivirus vendors. |
|
||||||
|
|
||||||
Please include the following files and folders in your antivirus' exclusion list to prevent issues due to antivirus detections: |
|
||||||
|
|
||||||
\`\`\` |
|
||||||
C:\Program Files\ExplorerPatcher |
|
||||||
%APPDATA%\ExplorerPatcher |
|
||||||
C:\Windows\dxgi.dll |
|
||||||
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy |
|
||||||
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy |
|
||||||
\`\`\` |
|
||||||
|
|
||||||
For Defender, you can run the following script in PowerShell as an administrator: |
|
||||||
|
|
||||||
\`\`\` |
|
||||||
Add-MpPreference -ExclusionPath \"C:\Program Files\ExplorerPatcher\" |
|
||||||
Add-MpPreference -ExclusionPath \"\$env:APPDATA\ExplorerPatcher\" |
|
||||||
Add-MpPreference -ExclusionPath \"C:\Windows\dxgi.dll\" |
|
||||||
Add-MpPreference -ExclusionPath \"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\" |
|
||||||
Add-MpPreference -ExclusionPath \"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\" |
|
||||||
\`\`\` |
|
||||||
|
|
||||||
### **Failure to exclude ExplorerPatcher's files may result in inability to install/uninstall ExplorerPatcher and explorer.exe being unable to start.** |
|
||||||
|
|
||||||
If you do not trust this process, please refrain from using ExplorerPatcher and look for alternatives instead. |
|
||||||
|
|
||||||
Microsoft, if you are reading this, please reconsider the detections as [there are a lot of users who trust this program and that risks from future EP developers are a thing.](https://www.youtube.com/watch?v=R50myh-AAe0) |
|
||||||
|
|
||||||
This issue was closed automatically. You want to discuss this in https://github.com/valinet/ExplorerPatcher/issues/3670." |
|
||||||
|
|
||||||
# Escape the Markdown content for proper JSON formatting |
|
||||||
COMMENT_BODY_ESCAPED=$(printf "%s" "$COMMENT_BODY" | jq -Rs .) |
|
||||||
|
|
||||||
# Post a comment on the issue with formatted text |
|
||||||
curl -X POST \ |
|
||||||
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ |
|
||||||
-d "{\"body\": $COMMENT_BODY_ESCAPED}" \ |
|
||||||
"https://api.github.com/repos/$REPO/issues/$ISSUE_NUMBER/comments" |
|
||||||
|
|
||||||
# Add the "duplicate" label to the issue |
|
||||||
curl -X POST \ |
|
||||||
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ |
|
||||||
-d '{"labels":["duplicate"]}' \ |
|
||||||
"https://api.github.com/repos/$REPO/issues/$ISSUE_NUMBER/labels" |
|
||||||
|
|
||||||
# Close the issue |
|
||||||
curl -X PATCH \ |
|
||||||
-H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \ |
|
||||||
-d '{"state": "closed"}' \ |
|
||||||
"https://api.github.com/repos/$REPO/issues/$ISSUE_NUMBER" |
|
||||||
Loading…
Reference in new issue